[1483] in linux-security and linux-alert archive
[linux-security] More sendmail problems... Partition your disks!
daemon@ATHENA.MIT.EDU (Alexander O. Yuriev)
Mon Mar 24 12:32:13 1997
From: "Alexander O. Yuriev" <alex@yuriev.com>
To: linux-security@redhat.com
cc: linux-alert@redhat-com.redhat.com
Date: Mon, 24 Mar 97 12:16:27 -0500
Resent-From: linux-security@redhat.com
Reply-To: linux-security@redhat.com
This is yet-another reason to _partition_ your disks. Of course hard links
do not work accross filesystems. Even thought it is a pain in the neck to do
when installing your operating system, think about separating critical
system files from non-critical and non-system files from system files. I
would say that the following layout is a good place to start:
/
/usr (nosuid,nodev,ro)
/usr/local (nosuid,nodev,ro)
/usr/local/sbin (nodev,ro)
/tmp (nosuid,noexec,nodev)
/var (nosuid,noexec,nodev)
/opt (nosuid,nodev,ro)
/services (nosuid,noexec,nodev)
/home (nosuid,nodev)
Alex
------- Forwarded Message
Return-Path: owner-bugtraq@netspace.org
Reply-To: C0WZ1LL4@netspace.org
Sender: Bugtraq List <BUGTRAQ@netspace.org>
From: C0WZ1LL4@netspace.org
Approved: alex@yuriev.com
To: BUGTRAQ@netspace.org
Hello fellow mongoloids
Try this:
Make hard link of /etc/passwd to /var/tmp/dead.letter
Telnet to port 25, send mail from some bad email address to some unreacheable hoost.
Watch your message get appended to passwd.
ie:
cowzilla::0:0:c0wz1ll4 0wns u:/:/bin/sh
This is not good. Worked with my 8.8.4, will probably also work with 8.8.5
Root for the whole family
- -Cowzilla the omnipotent b0v1n3
PD
Greets to various #2600 people
------- End of Forwarded Message
